Who can change your systems tonight?

By morning, the damage was no longer digital. Supermarket staff were clearing spoiled food from refrigeration units that had become dangerously warm. Around 700 French supermarkets were affected by the October attacks; some units reportedly reached 50°C. The disruption required no stolen customer database to become a business crisis.

France’s CERT-FR warning confirms compromises of refrigeration controllers from Danfoss, Copeland and Dixell. Its advice was direct: remove internet exposure and restore remote access only through a secure VPN or protected network. A factory reset alone would not make an unsupported, exposed device safe.

The precise entry route remained unclear. That distinction matters: compromised equipment does not prove that the manufacturer’s own network, or a maintenance company’s account, was breached.

Further refrigeration incidents were reported across several European countries on 2 November. They reinforce the urgency, but should not be presented as a proven continuation by the same attackers.

The access behind the service

Financial firms do not run supermarket freezers. They do, however, give IT support companies, managed service providers and platform vendors access to systems that keep the business operating.

The useful comparison is not the equipment. It is the authority granted through a remote connection. Can an outside party change a production setting, disable an alert or interrupt a critical service—and would anyone inside the firm notice before customers did?

A supplier list is not an access inventory. Knowing who you buy from is different from knowing which named users can reach which systems, with what privileges, and for how long.

Where regulation meets the practical risk

NIS2 Article 21(2)(d) requires in-scope organisations to address supply-chain security, including relationships with direct suppliers and service providers. Annex I also includes managed service and managed security service providers, subject to the applicable scope rules. Neither point means every supermarket or refrigeration contractor automatically falls under NIS2.

For financial entities covered by DORA, Articles 9, 28 and 30 connect access controls and strong authentication with third-party risk management and contractual safeguards. Outsourcing a service does not outsource responsibility for the risk.

Three questions turn those obligations into a useful board discussion:

1. Which suppliers can access or change critical systems today, and can we evidence who approved that access?
2. Is access individually authenticated, limited to approved tasks and logged—with alerts for consequential changes?
3. Can we revoke a compromised supplier’s access quickly without losing our ability to operate, and have we tested that?

The question is not simply whether your supplier is secure. It is what their access allows someone to do to your business tonight.